CVE-2026-53149
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound root directory content to block size __tb_property_
CVSS
7.1
High
EPSS
0.1%
p2
KEV
—
Exploit Today
1
0-100
Published: Jun 25, 2026 · Last modified: Oct 15, 2026 · CWE-125
0.1%EPSS · 30 days0.1%
2026-09-272026-10-25
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound root directory content to block size __tb_property_parse_dir() does not check that content_offset + content_len fits within block_len for the root directory case. When rootdir->length equals or exceeds block_len - 2, the entry loop reads past the allocated property block. Add a bounds check after computing content_offset and content_len to reject directories whose content extends past the block.
- git.kernel.orghttps://git.kernel.org/stable/c/0a32040a48db8cf35de48b85d6115df5623e4964
- git.kernel.orghttps://git.kernel.org/stable/c/1912be23daf4afc8d24ce916021ab68ca4c679db
- git.kernel.orghttps://git.kernel.org/stable/c/4d0b1524caadb04c10a71f3f88692c63dcb39115
- git.kernel.orghttps://git.kernel.org/stable/c/5c7657d38d07268124782f03519f07c22a5814fb
- git.kernel.orghttps://git.kernel.org/stable/c/60ba6217460792356a238299edd675d91d46bab4
- git.kernel.orghttps://git.kernel.org/stable/c/65423079c7420e3dbf9a7aa345c243a3f5752e5d
- git.kernel.orghttps://git.kernel.org/stable/c/b212bc161d8a9937b42153723a4a3f2f74fab528
- git.kernel.orghttps://git.kernel.org/stable/c/cbeb68cbaa0a6f979ef428a7f2d0268c082ba166
- cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-784472.html
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-829477.1 HIG—
——0SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read data outside allocated buffers. The software uses length and offset values from device messages without validating them against buffer sizes. This can cause the master to access invalid memory locations, potentially disclosing sensitive information or causing crashes.7hCVE-2026-829436.5 MED—
——0SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device can send messages that cause the master to read data from memory locations beyond the intended buffer. The software uses length values from device responses without validating them against actual buffer sizes. An attacker can exploit this to extract up to 64KB of data from the master's memory.7hCVE-2026-1079007.8 HIG—
——0V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!CCheck::ItemCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.9hCVE-2026-1078997.8 HIG—
——0V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.9hCVE-2026-1078987.8 HIG—
——0V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::MacroCommandCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.9hCVE-2026-1078977.8 HIG—
——0V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.9h